tegwick
90d809a486
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
121 lines
6.3 KiB
Markdown
121 lines
6.3 KiB
Markdown
---
|
|
id: USER-WP-0025
|
|
type: workplan
|
|
title: "Make operator navigation and portal logout usable during demo onboarding"
|
|
domain: communication
|
|
repo: user-engine
|
|
status: active
|
|
owner: the-custodian
|
|
topic_slug: user-engine
|
|
created: "2026-09-11"
|
|
updated: "2026-09-12"
|
|
related: [RAPPS-WP-0014, USER-WP-0020, KEY-WP-0025]
|
|
state_hub_workstream_id: "85391398-f5be-551b-b90d-c8e987a00098"
|
|
---
|
|
|
|
During demo-company onboarding the operator signs in as platform-root, sees
|
|
“No tenant memberships yet”, cannot find the existing tenant, and requests a
|
|
logout control. Source confirms that personal memberships are distinct from the
|
|
platform-operator role. Read-only live consumer verification confirms the tenant
|
|
active with two memberships (one administrator and one ordinary user), neither
|
|
linked to a directory identity yet. Do not add a customer membership to the
|
|
platform operator to work around missing navigation.
|
|
|
|
## Expose authorized navigation and a protected portal logout
|
|
|
|
```task
|
|
id: USER-WP-0025-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "2f40807f-5442-5bca-8c38-c2d084f8e1ef"
|
|
```
|
|
|
|
Render shared navigation on authenticated pages, with platform administration
|
|
only for verified platform operators, tenant user management for tenant admins,
|
|
and an accessible POST logout form using the current browser session's CSRF
|
|
value. Keep navigation request-scoped and clear it even after failures. Explain
|
|
personal memberships to operators and add a Manage users route from the existing
|
|
platform tenant lookup/lifecycle page. Keep authority checks unchanged.
|
|
|
|
GET /logout only displays confirmation. POST verifies CSRF for an active session,
|
|
invalidates that session server-side, expires its cookie, and leads to a logged-out
|
|
page explaining the remaining shared sign-in session. Expired sessions may clear
|
|
their stale cookie without affecting another session. This is portal logout;
|
|
provider-wide sign-out/account switching remains the explicit next task below.
|
|
|
|
Validation: make test passes (177 tests, three optional integration skips) and
|
|
layer conformance passes. Eight regressions cover operator access without membership,
|
|
ordinary-user denial, navigation isolation, logout CSRF, session invalidation,
|
|
expired-session cleanup, short-name resolution and ambiguous-name refusal. Ten local Chromium checks pass for operator guidance, navigation to tenant
|
|
users, mobile navigation, visible logout, session cookie removal and denied
|
|
access after logout. Immutable image promotion and native verification are T02.
|
|
|
|
## Publish and verify the visible change on the native portal
|
|
|
|
```task
|
|
id: USER-WP-0025-T02
|
|
status: done
|
|
priority: high
|
|
needs_human: false
|
|
state_hub_task_id: "67e2feca-ffcd-55a0-b0ce-2bab43c862e4"
|
|
```
|
|
|
|
Check the browser flow on a local synthetic fixture, publish the exact source
|
|
through existing Forgejo image CI, pin the resulting digest in rapp-user-engine,
|
|
and promote only the current User Engine Deployment's image. Preserve requests,
|
|
service identity, database, policies and secrets. Verify health/readiness and
|
|
native operator navigation/logout when the operator is available. Deployment
|
|
restarts invalidate the portal's in-memory sessions, so provide the sign-in URL.
|
|
Actual demo-user Create login and password setup remain RAPPS-WP-0014-T02.
|
|
|
|
Release deployed on 2026-09-12: source 655dce7165eace6374da8a58e6a20a826f1a1a51,
|
|
Forgejo smoke 119 and publication 120 succeeded. Runtime now pins
|
|
forgejo.coulomb.social/coulomb/user-engine@sha256:38e110b0e30edc56900f8adea2da9c720e271f73543ff73ac905106308ac2f4d
|
|
with 1/1 Ready at unchanged 50m CPU/64Mi memory requests. The exact UID,
|
|
resourceVersion and previous image were tested before the image-only patch;
|
|
server dry-run and rollout succeeded. Public health and readiness return 200,
|
|
/logged-out serves the new scoped explanation, and unauthenticated tenant
|
|
administration remains 403. Local Chromium passed eight synthetic UI checks.
|
|
The operator confirmed native login and logout work on 2026-09-12. Tenant
|
|
selection then triggered browser format validation. The follow-up adds clickable
|
|
tenant names from the distinct membership index and accepts a unique short name
|
|
for lookup, retaining exact identifiers for ambiguity. This index is User
|
|
Engine membership data, not a complete Tenant Engine inventory. Unknown and
|
|
ambiguous names return inline guidance without guessing a tenant or changing
|
|
memberships. Known-tenant selection appears before tenant creation.
|
|
|
|
Follow-up validation: 177 tests (three optional skips), layer conformance and ten
|
|
local Chromium checks pass. The browser submits demo-company without a pattern
|
|
error and reaches its users; direct name selection works too. Publication,
|
|
promotion completed from source d177d479751b7bb2d22c5316de426ad3fd7609a1.
|
|
Forgejo smoke 123 and publication 124 passed; the current runtime is
|
|
forgejo.coulomb.social/coulomb/user-engine@sha256:558e049826c3f7fdda6dd103b8cea9dce1b482ed6ded5bc4b0dfd8fe3392fc7a
|
|
with 1/1 Ready and unchanged 50m/64Mi requests. The deployed PostgreSQL adapter
|
|
confirms demo-company is selectable. The operator then reports successful user
|
|
password setup, and live read-only evidence shows three memberships and one
|
|
linked identity. Native login/logout and user access are confirmed; the latest
|
|
short-name behavior is covered by local Chromium plus the deployed index check.
|
|
The missing provider-to-product welcome handoff is retained as VERGABE-WP-0019-T06,
|
|
not claimed by this portal release.
|
|
|
|
## Coordinate provider-wide sign-out and account switching
|
|
|
|
```task
|
|
id: USER-WP-0025-T03
|
|
status: progress
|
|
priority: medium
|
|
state_hub_task_id: "f5ee70b9-f169-5316-af3e-5dbbdd394d57"
|
|
```
|
|
|
|
Coordinate the relying-party, KeyCape and Authelia session boundaries so one
|
|
explicit user action can end all relevant browser sessions and allow another
|
|
account to authenticate. KeyCape currently documents local-only logout in
|
|
KEY-WP-0025 and docs/operations.md. Do not claim global logout or JWT revocation
|
|
from User Engine's cookie deletion. Use registered return locations and verify
|
|
same-account login cannot silently reappear after complete sign-out. Preserve
|
|
session-only logout for users who intend to keep their other applications open.
|
|
|
|
2026-09-12: shared sign-out implemented with USER-WP-0026 and KEY-WP-0034.
|
|
Portal logout hands off to explicit issuer confirmation, then provider-owned
|
|
Authelia logout with a fixed portal return. Actual signed-in account switching
|
|
awaits operator browser evidence; already issued JWTs are not revoked.
|